✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
PassiveNeuron: Unraveling the 2024–2025 Advanced Persistent Attack on Global Servers
Between June 2024 and August 2025, the advanced persistent threat (APT) campaign codenamed "PassiveNeuron" targeted government, financial, and industrial organizations primarily across Asia, Africa, and Latin America. Attackers exploited SQL servers—likely leveraging vulnerabilities or credential brute-forcing—to gain initial access, followed by repeated attempts to deploy web shells. When thwarted by robust endpoint protections, the attackers escalated to advanced techniques, implementing a multi-stage DLL loader chain to deliver custom implants ('Neursite' and 'NeuralExecutor') and leveraging Cobalt Strike for lateral movement and persistence. These tools enabled sophisticated data gathering, process management, and network proxying, all while leveraging various encryption and obfuscation tactics to evade detection. This incident exemplifies the ongoing evolution of targeted cyberespionage against server infrastructure, with attribution leaning towards a Chinese-speaking threat actor based on tactics and C2 infrastructure, though with some ambiguity due to apparent false flags. It reflects a rise in multi-stage, stealthy attacks leveraging both custom and widely abused tools, highlighting the elevated risk posed to internet-exposed critical servers.
6 months ago
Kill Chain
2025’s Phishing Evolution: QR-PDFs, Calendar Attacks, and MFA Relay
In early 2025, organizations faced a surge of advanced phishing attacks leveraging revitalized and sophisticated tactics. Threat actors used emails with password-protected PDF attachments containing QR codes, evading traditional email security solutions and enticing users to open links via less-protected mobile devices. Calendar invitations embedding phishing links, voice message lures with CAPTCHA-guarded landing pages, and high-fidelity credential harvesting forms that relayed real MFA challenges in real-time all contributed to more successful credential thefts. These approaches eroded user trust in standard verification mechanisms and bypassed established detection methods, leading to increased account compromise risks and potential business disruptions. This shift signals a broader trend of attackers reusing and refining both traditional and novel phishing techniques, with rising use of multi-step evasion and identity-focused targeting. Enterprise email, cloud collaboration services, and end user authentication have become critical targets, driving new regulatory scrutiny and requirements for layered, adaptive defenses.
6 months ago
Kill Chain
Silver Fox Targets Japan & Malaysia: Winos 4.0 & HoldingHands RAT in Regional Cyber Attack
In October 2025, the Silver Fox cybercrime group broadened their Winos 4.0 (ValleyRAT) operations outside China and Taiwan by targeting organizations in Japan and Malaysia using the recently identified HoldingHands RAT (also called Gh0stBins). Attackers used phishing emails containing malicious PDFs with embedded links, leading recipients to unknowingly download and execute the remote access Trojan. Once deployed, the malware allowed unauthorized access and remote control over infected endpoints, posing significant threats to sensitive data and operational integrity for both public and private sector entities in the affected regions. This breach underscores the growing prevalence of multi-stage phishing attacks orchestrated by established threat actors, and highlights the transnational expansion of remote access trojan campaigns in Asia. The incident increases urgency for regional organizations to strengthen email security, endpoint defenses, and adopt zero-trust principles as attacker sophistication and geographic reach expand.
6 months ago
Kill Chain
Europol Busts Global SIM Farm Fueling Industrial-Scale Fake Accounts and Cybercrime
In October 2025, Europol led Operation SIMCARTEL to dismantle a sophisticated cybercrime-as-a-service (CaaS) organization running an extensive SIM farm network. This criminal service provisioned more than 49 million SIM cards to cybercriminals worldwide, enabling the rapid creation and management of fake online accounts. Threat actors leveraged the infrastructure for phishing campaigns, investment fraud, impersonation, and large-scale social engineering schemes, causing substantial financial and reputational harm to both individuals and businesses. The coordinated law enforcement operation involved 26 property searches, resulted in seven arrests, and the seizure of equipment and digital assets tied to the illicit platform. This incident highlights the growing industrialization of cybercrime, where turnkey services significantly lower the barrier to entry and accelerate threat actor operations. Law enforcement and the security industry face increasing challenges as cybercriminals exploit scalable CaaS platforms, requiring organizations to modernize their defenses and policy enforcement.
6 months ago
Kill Chain
NSA’s Multi-Tool Cyber Assault on Beijing’s National Time Service Center: Lessons for Critical Infrastructure
In October 2025, China's Ministry of State Security (MSS) accused the U.S. National Security Agency (NSA) of orchestrating a sophisticated, multi-stage cyberattack against the National Time Service Center (NTSC) in Beijing. The MSS claims that the NSA deployed at least 42 distinct cyber tools to penetrate critical national infrastructure, leveraging advanced techniques such as encrypted and east-west traffic manipulation, zero trust segmentation circumvention, and covert remote access. The compromise included strategic lateral movement and evasion of detection, reportedly leaving a significant impact on the operational integrity of NTSC, which serves as a reference point for the nation’s official timekeeping and scientific endeavors. This incident marks an escalation in cyber power projection between nation-states and spotlights the increasing use of multi-tool modular attack frameworks by advanced persistent threats (APTs). The breach underscores the urgency for critical infrastructure operators worldwide to reevaluate network segmentation, encrypted communications, and visibility gaps in light of evolving nation-state tactics.
6 months ago
Kill Chain
131 Chrome Extensions Hijack WhatsApp Web: The 2025 Brazilian Spam Campaign
In October 2025, a coordinated cyberattack was uncovered where 131 malicious Chrome browser extensions—clones of a popular WhatsApp Web automation tool—were used to hijack users’ sessions and launch an automated spam campaign targeting Brazilian users. Researchers from security company Socket found that these plugins, sharing an identical codebase and infrastructure, infected over 20,000 users by enticing them to install seemingly legitimate add-ons, enabling attackers to take control of browser sessions, inject spam messages, and exfiltrate private data at scale. The incident underscores the risks associated with browser extension supply chain threats, exposing enterprises and individuals to large-scale account compromise and privacy breaches. This breach is particularly significant as it demonstrates the adaptability and persistence of threat actors in abusing browser supply routes and leveraging rebranded extensions to evade traditional security controls. The campaign’s targeting of WhatsApp Web also signals a shift toward exploiting widely-used communication channels for coordinated spam and fraud, spotlighting the critical need for proactive browser extension vetting and user awareness.
6 months ago
Kill Chain
ClickFix Copy/Paste Attacks: How Browser-Based Social Engineering Breached Enterprises in 2025
In October 2025, multiple organizations were impacted by the emerging 'ClickFix' attack trend, in which threat actors leveraged deceptive browser-based prompts (like fake CAPTCHAs or repair dialogs) to manipulate users into copy-pasting malicious code or credentials. These social engineering attacks typically bypassed standard email or endpoint security controls by exploiting a user's trust in solving browser-based challenges, resulting in credential compromise, unauthorized access, and subsequent lateral movement within enterprise environments. The attackers maintained persistence by mimicking legitimate error messages and encouraging users to interact further, drastically increasing the potential for data exfiltration and ransomware deployment. This breach highlights a surge in adversary-in-the-browser tactics, with copy/paste manipulation rapidly becoming a favored method among cybercriminals due to its high success rate and the minimal technical barriers for execution. The incident underscores the growing need for organizations to adopt advanced east-west traffic controls, enforce strong zero trust segmentation, and continually educate users about novel, non-traditional social engineering threats.
6 months ago
Kill Chain
The F5 2025 Multi-Vector Breach: A Wake-up Call for Hybrid Cloud Defense
In October 2025, F5 Networks experienced a sophisticated multi-vector cyber breach in which attackers gained undetected foothold within its environment for a prolonged period. The adversaries reportedly exploited a combination of Linux rootkits, encrypted traffic evasion, and a new attack method known as Pixnapping to laterally move between internal workloads and exfiltrate sensitive data. Their persistence was enabled by bypassing both east-west and egress security controls, leveraging cloud-native environments and covert remote access tools, before the intrusion was detected. Business operations were disrupted, and F5 initiated incident response and regulatory disclosures. This breach underscores the urgent reality that advanced attackers employ stealthy, multi-stage tactics, exploiting visibility gaps, lateral pathways, and cloud complexity. As such, it highlights the evolving need for proactive threat detection, zero trust segmentation, and continuous monitoring in today’s hybrid enterprise landscapes.
6 months ago
Kill Chain
Oracle E-Business Suite Vulnerability Breach: CVE-2025-61884 Exploited in Active Attacks
In October 2025, attackers exploited CVE-2025-61884, a critical vulnerability in Oracle E-Business Suite (EBS), enabling unauthorized remote access and manipulation of sensitive enterprise data. The breach surfaced after CISA added the flaw to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. Adversaries leveraged the unpatched vulnerability to gain foothold in targeted organizations, potentially leading to data theft, operational disruption, and exposure of personal and financial information stored within Oracle EBS environments. Remediation required immediate patching and review of east-west traffic alongside network segmentation measures. This incident underscores the steady targeting of enterprise SaaS platforms via zero-day and n-day flaws, and the increasing urgency for organizations to rapidly address vulnerabilities as soon as they are disclosed. With threat actors now weaponizing newly published vulnerabilities at an accelerated pace, organizations face renewed regulatory and business pressures to align with security best practices and compliance mandates.
6 months ago
Kill Chain
PolarEdge Botnet Targets Cisco, ASUS, QNAP, Synology Routers in 2025 Operation
In February 2025, security researchers uncovered a sophisticated botnet campaign dubbed PolarEdge, targeting router devices produced by Cisco, ASUS, QNAP, and Synology. The attackers leverage a custom TLS-based ELF implant to compromise home and enterprise routers, enlisting them into an expanding botnet. Initial infection vectors are believed to exploit known and zero-day vulnerabilities in router firmware, granting the threat actors persistent access and control over thousands of devices globally. The current purpose of the PolarEdge botnet remains undetermined, but activity suggests ongoing monitoring, traffic manipulation, and possible lateral movement within affected networks. Organizations with exposed or outdated devices face heightened operational risk, including surveillance, DDoS, and data interception. This incident underscores the growing menace of router-based botnets leveraging encrypted payloads and advanced evasion techniques. With a surge in attacks on network edge hardware and the proliferation of Internet of Things (IoT) devices, organizations must prioritize firmware patching, network segmentation, and comprehensive threat detection to mitigate emerging risks.
6 months ago
Kill Chain
Inside the Synthient Stealer Log Threat Data: 2025's Monumental Infostealer Breach
In late 2025, a vast dataset known as the 'Synthient Stealer Log Threat Data' surfaced, aggregating over 3.5 terabytes and 23 billion rows of stolen credentials and website entries collected from infostealer malware and credential stuffing campaigns. This dataset comprised logs exfiltrated via platforms like Telegram, social media, and dark web forums, predominantly sourced from malware-infected endpoints. Analysis revealed 183 million unique email addresses, with over 8% never before seen in data breach collections, confirming both scale and uniqueness. The data's authenticity was validated through subscriber checks and corroborating evidence from exposed accounts. This incident underscores the escalating risks posed by mass infostealer malware campaigns, highlighting their ability to industrialize credential theft and rapidly distribute sensitive personal data. As attackers continuously refine malware arsenals and leverage broader distribution networks, organizations and individuals must act urgently to address credential reuse, enhance detection, and mitigate lateral movement threats.
6 months ago
Kill Chain
NSA-Linked Cyberattack Highlights Risks to China’s National Time Service Center (2023–2024)
Between March 2022 and June 2024, China’s National Time Service Center reportedly fell victim to a sophisticated cyber-espionage campaign allegedly orchestrated by the U.S. National Security Agency (NSA). Attackers initially compromised employee mobile devices via a text-messaging service vulnerability, leading to credential theft and enabling unauthorized access to the Center’s internal systems by April 2023. From August 2023 onward, the NSA purportedly leveraged a suite of 42 advanced cyber tools to target sensitive infrastructure, using VPNs and forged certificates to evade detection and bypass defenses. The attack put critical services at risk, with potential consequences including network disruption, financial system instability, and interruptions to vital communications and national defense functions. This incident underscores escalating nation-state cyber competition, especially over foundational infrastructure. The methods used—mobile device exploitation, lateral movement, and evasion through encrypted channels—reflect trending Tactics, Techniques, and Procedures (TTPs) in state-sponsored attacks, raising concerns for governments and critical sectors worldwide about supply chain and timing-related risks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports